[PATCH net v2 1/2] ipv4: recompile IP options on a private copy in ipv4_send_dest_unreach()

[Eric Dumazet <edumazet@kernel.org>]

__ip_options_compile() updates Record Route and Timestamp options in
place. ipv4_send_dest_unreach() can receive skbs whose data is shared
with clones (for example TC-mirred copies or TCP transmit clones), and
pskb_network_may_pull() does not unshare an already linear IPv4 header.

Concurrent link-failure processing of such clones can therefore change
an option pointer after it has been checked. For example, a Record Route
pointer can advance during fib_compute_spec_dst() (called from
spec_dst_fill()), causing the following write to overwrite the next
option's length. __ip_options_echo() then trusts that length when
building the ICMP reply, which can overflow both the stack reply-option
buffer and the cork-option allocation.

Uncloning the skb is not an option: ipv4_send_dest_unreach() runs as
the dst_link_failure() callback, and callers such as ip_tunnel_xmit()
keep pointers into skb->head (inner_iph, and tnl_params for GRE devices
with header_ops) across the call.

Instead, recompile and echo the options on a private pskb_copy(),
leaving the caller's skb untouched. This also stops rewriting the
options of a packet the caller may still transmit. If the copy fails,
do not send the ICMP error.

The issue was found by an AI code review agent. It was not reproduced,
and the fix was only build-tested.

Fixes: ed0de45a1008 ("ipv4: recompile ip options in ipv4_link_failure")
Reported-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
v2: use a private pskb_copy() instead of skb_unclone(), callers of
    dst_link_failure() cache pointers into skb->head (Sashiko).
v1: https://lore.kernel.org/netdev/20261106234313.2537882-1-edumazet@kernel.org/

 net/ipv4/route.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 3a90c8d28b940bf615c165d9b30ac634943586e1..9af72cb892034deff2bb3169911c02c025d73cf2 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1256,6 +1256,7 @@ EXPORT_INDIRECT_CALLABLE(ipv4_dst_check);
 
 static void ipv4_send_dest_unreach(struct sk_buff *skb)
 {
+	struct sk_buff *nskb = NULL;
 	struct inet_skb_parm parm;
 	struct net_device *dev;
 	int res;
@@ -1271,6 +1272,16 @@ static void ipv4_send_dest_unreach(struct sk_buff *skb)
 	if (ip_hdr(skb)->ihl > 5) {
 		if (!pskb_network_may_pull(skb, ip_hdr(skb)->ihl * 4))
 			return;
+
+		/* __ip_options_compile() writes into the options, and
+		 * callers of dst_link_failure() may cache pointers into
+		 * skb->head: work on a private copy.
+		 */
+		nskb = pskb_copy(skb, GFP_ATOMIC);
+		if (!nskb)
+			return;
+		skb = nskb;
+
 		parm.opt.optlen = ip_hdr(skb)->ihl * 4 - sizeof(struct iphdr);
 
 		rcu_read_lock();
@@ -1279,9 +1290,11 @@ static void ipv4_send_dest_unreach(struct sk_buff *skb)
 		rcu_read_unlock();
 
 		if (res)
-			return;
+			goto out;
 	}
 	__icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &parm);
+out:
+	consume_skb(nskb);
 }
 
 static void ipv4_link_failure(struct sk_buff *skb)
-- 
2.53.0